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Why GAO Did This Study 

Concerns have grown that terrorists 
could use radioactive materials and 
sealed sources (materials sealed in a 
capsule) to build a "dirty bomb" — a 
device using conventional explosives 
to disperse radioactive material. In 
2003, GAO found weaknesses in the 
Nuclear Regulatory Commission's 
(NRC) radioactive materials 
licensing process and made 
recommendations for improvement. 
For this report, GAO assesses (1) the 
progress NRC has made in 
implementing the 2003 
recommendations, (2) other steps 
NRC has taken to improve its ability 
to track radioactive materials, (3) 
Customs and Border Protection's 
(CBP) ability to detect radioactive 
materials at land ports of entry, and 
(4) CBP's ability to verify that such 
materials are appropriately licensed 
prior to entering the United States. 
To perform this work, GAO assessed 
documents and interviewed NRC and 
CBP officials in headquarters and in 
several field locations. 
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ensure that the current target dates 
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recommends CBP more effectively 
communicate guidance on when 
officers must verify the legitimacy of 
radioactive materials and take steps 
to ensure that this guidance is being 
followed. NRC neither agreed nor 
disagreed with GAO's findings and 
recommendations but described its 
efforts to implement GAO's 2003 
recommendations and its plans to 
implement GAO's 2008 
recommendations. CBP agreed with 
GAO's recommendations. 
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What GAO Found 

NRC has implemented three of the six recommendations in GAO's 2003 report on 
the security of radioactive sources. It has worked with the 35 states to which it 
ceded primary authority to regulate radioactive materials and sources and others 
to (1) identify sealed sources of greatest concern, (2) enhance requirements to 
secure radioactive sources, and (3) ensure security requirements are 
implemented. In contrast, NRC has made limited progress toward implementing 
recommendations to (1) modify its process for issuing licenses to ensure that 
radioactive materials cannot be purchased by those with no legitimate need for 
them, (2) determine how to effectively mitigate the potential psychological effects 
of malicious use of such materials, and (3) examine whether certain radioactive 
sources should be subject to more stringent regulations. Beyond acting on GAO's 
recommendations, NRC has also taken four steps to improve its ability to monitor 
and track radioactive materials. First, NRC created an interim national database 
to monitor the licensed sealed sources containing materials that pose the greatest 
risk of being used in a dirty bomb. Second, NRC is developing a National Source 
Tracking System to replace the interim database and provide more 
comprehensive, frequently updated information on potentially dangerous 
sources. However, this system has been delayed by 18 months and is not 
expected to be fully operational until January 2009. Third, NRC is also developing 
a Web-based licensing system that will include more comprehensive information 
on all sources and materials that require NRC or state approval to possess. 
Finally, NRC is developing a license verification system that will draw 
information from the other new systems to enable officials and vendors to verify 
that those seeking to bring these radioactive materials into the country or 
purchase them are licensed to do so. However, these systems are more than 3 
years behind schedule and may not include the licensing information, initially at 
least, on radioactive materials regulated by agreement states — which represent 
over 80 percent of all U.S. licenses for such materials. The delays in the 
deployment and full development of these systems are especially consequential 
because NRC has identified their deployment as key to improving the control and 
accountability of radioactive materials. 

While CBP has a comprehensive system in place to detect radioactive 
materials entering the United States at land borders, some equipment that is 
used to protect CBP officers is in short supply. Specifically, vehicles, cargo, 
and people entering the United States at most ports of entry along the 
Canadian and Mexican borders are scanned for radioactive materials with 
radiation detection equipment capable of detecting very small amounts of 
radiation. However we found that personal radiation detectors are not 
available to all officers who need them. Moreover, while CBP has systems in 
place to verify the legitimacy of radioactive materials licenses, it has not 
effectively communicated to officers at the borders when they must contact 
officials to verify the license for a given sealed source. Consequently, some 
CPB officers are not following current guidance, and some potentially 
dangerous radioactive materials have entered the country without license 
verification. 
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Radioactive sealed sources, which are commonly used throughout the 
world for a variety of purposes, are radioactive materials sealed in a 
capsule or permanently bonded in a solid form. These sealed sources are 
used in medicine and in the oil and gas, electric power, construction, and 
food industries. For example, devices containing radioactive sealed 
sources are used to diagnose and treat millions of patients each year, 
sterilize items such as medical instruments and food, and detect flaws in 
the metal welds in pipelines. Currently, about 2 million sealed sources are 
licensed for use in the United States. Since terrorists attacked the United 
States in 2001, concerns have grown that they could obtain and use sealed 
sources to build a "dirty bomb" — a type of radiological dispersal device 
(RDD) that uses conventional explosives to disperse radioactive material. 

The consequences of detonating an RDD depend on the amount and type 
of radioactive material used and the size and characteristics of the area in 
which the material is dispersed. In many scenarios, an RDD would cause 
few deaths or injuries, but significant economic effects could result. In 
particular, the affected area would need to be decontaminated and people 
who work or live in the affected area might not return to their homes or 
businesses for an extended period of time because they fear the 
consequences. Generally, the smaller or more confined the area in which a 
given amount of radioactive material is dispersed, the more severe the 
consequences. Accordingly, depending upon the circumstances, even 
small amounts of material can be potentially dangerous. For example, a 
relatively small quantity of a particular material dispersed over many city 
blocks could be disruptive and result in an evacuation while first 
responders assessed the extent of the contamination and determined the 
need for a cleanup. In this case, the small quantity of this material might 
not cause immediate health effects or require significant cleanup, but it 
could result in economic and psychological consequences if people were 
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temporarily evacuated from their businesses and homes. However, the 
same small quantity of the same material dispersed in a more confined 
setting, such as a restaurant or enclosed subway station, would also result 
in an evacuation and would prevent people from returning to the affected 
area until a more extensive cleanup could be completed. Moreover, those 
exposed to radiation under this scenario could experience radiation 
sickness, with symptoms that include nausea, vomiting, and diarrhea. If 
exposure is extended, the result can be permanent injury or death. Finally, 
larger amounts of this same radioactive material spread over a larger area 
could produce more significant consequences. (For further discussion of 
the potential effects of an RDD, see app. I.) 

Until 2001, oversight of radioactive sealed sources in the United States 
largely focused on ensuring that such sources were licensed as required 
and used and stored safely. In the years after 2001, security concerns 
surrounding radioactive sealed sources received greater attention 
nationally and internationally. For example, in May 2003, the Nuclear 
Regulatory Commission (NRC) and the Department of Energy (DOE), 
relying in part on a 2002 study by Sandia National Laboratories 1 that, 
among other things, identified several radionuclides — the particular types 
of radioactive material used in sealed sources — that are most commonly 
used in the United States and that pose the greatest risk of being used by 
terrorists to make an RDD. 2 Also that year, the International Atomic 
Energy Agency (IAEA) published a system for ranking quantities of 
individual radionuclides into one of five categories on the basis of their 
potential to harm human health. 3 Under IAEA's system, a given 
radionuclide is considered "dangerous" when gathered in close proximity 
to people in sufficient quantity to cause direct human health effects. 4 A 



Sandia National Laboratories, located in Albuquerque, New Mexico, and Livermore, 
California, are 2 of the more than 20 national laboratories and technology centers overseen 
by DOE. 

2 A radionuclide is an unstable, radiation-emitting nuclide. A nuclide is a particular atomic 
form of an element distinguished from other nuclides by its number of neutrons and 
protons, as well as by the amount of energy it contains. Every known element has multiple 
(radio)nuclides. For example, cesium has many radionuclides, and each is suited to 
different purposes — cesium-133 is used in atomic clocks, and cesium-137 is used as an 
irradiator to sterilize blood and in other medical radiation devices for treating cancer. 

3 The IAEA Safety Guide #RS-G-1.9, "Categorization of Radioactive Sources," details the 
underlying methodology for the five-category scheme. 

4 Direct, or nonprobabilistic, human health effects are readily observable, may be acute, and 
are, accordingly, more severe than the elevated risk of a future health effect, such as 
cancer. 
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category 1 quantity of a given radionuclide, the most dangerous, is defined 
as an amount 1,000 times or more than the amount necessary to cause 
permanent human injury; a category 2 quantity is defined as an amount at 
least 10 times but less than 1,000 times the amount necessary to cause 
permanent human injury. A category 3 quantity of a given radionuclide is 
defined as at least the minimum amount, but less than 10 times the 
amount, sufficient to cause permanent injury. Category 4 and 5 quantities 
of radioactive materials are unlikely to cause permanent injury. In 
September 2003, the United States and other nations endorsed IAEA's 
Code of Conduct, which sets forth basic principles and guidance to 
promote the safe and secure use of sealed sources containing sufficient 
quantities of radioactive material to be categorized as dangerous. The 
Code of Conduct applies to categories 1, 2, and 3 — all of which are 
potentially dangerous to human health and could, if not properly 
controlled, cause permanent injuries or death to a person who handled it 
or who was otherwise in contact with it. 

How dangerous any given type of radioactive material is depends on its 
activity level, or intensity; how long exposure lasts; and the way in which 
the body is exposed to it — via inhalation, ingestion, or external exposure. 
The different types of radiation — including alpha, beta, gamma, and 
neutron — also vary in how easy or difficult they are to block, or shield, and 
this variation, in turn, affects the threat to health that a particular type of 
radiation poses. Depending on the intensity and length and manner of 
exposure, health effects range from death, to severe injury, to the 
development of cancer, to no discernable damage. For example, alpha 
radiation poses little threat to human health from external exposure but 
poses considerable health risks if inhaled or ingested. Gamma radiation is 
more penetrating and, if not properly shielded, can cause injury or death 
through external exposure. Although sources of neutron radiation are less 
common, neutron radiation is emitted from some materials that are used 
to make nuclear weapons. Thus, tools that can detect neutron radiation 
are particularly important for national security purposes, such as securing 
our borders. 

An underlying goal of federal and state regulation of radioactive materials 
is to protect people from health effects caused by exposure to harmful 
levels of radiation. The Atomic Energy Act gives NRC primary 
responsibility for regulating most domestic industrial, medical, and 
research uses of radioactive materials to protect public health and safety. 
The act authorizes NRC to relinquish primary regulatory authority over 
radioactive materials to states (called "agreement" states) that agree to 
meet certain conditions. To date, NRC has relinquished authority to 35 
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states to grant licenses to possess and use radioactive materials and sealed 
sources and conduct regular inspections of licensees to enforce 
compliance. NRC and numerous state governments license, monitor, track, 
and require security for radioactive materials in order to protect both 
workers and members of the general public from exposure to hazardous 
levels of radiation generated by the activities of their licensees. Given this 
mandate to regulate the radioactive material covered by their licenses, 
NRC and state regulators focus on the dangers posed by day-to-day 
occupational exposure to radiation and the direct health effects from 
industrial accidents. NRC periodically evaluates its own regulatory 
program and evaluates each agreement state's program for compatibility 
with NRC regulations. 

NRC and agreement states issue two types of licenses to authorize the 
possession of radioactive materials: specific licenses and general licenses. 
Specific licenses are issued for devices that contain relatively larger 
radioactive sealed sources. These devices, such as medical equipment 
used to treat cancer, cameras used for industrial radiography, and 
moisture and density gauges used in construction, generally require 
training to be used safely and may also need to be properly secured to 
avoid misuse. Organizations or individuals wanting to obtain a specific 
license must submit an application and gain the approval of either NRC or 
an agreement state. In contrast, devices approved for use under general 
license, such as luminous exit signs, normally contain relatively small 
radioactive sources. Such devices are designed with inherent radiation 
safety features, are widely commercially available, and do not require NRC 
or agreement state approval to possess. Of the approximately 22,000 
specific materials licenses in the United States, NRC administers about 
3,750, and the agreement states administer the rest. 

Other federal agencies' responsibilities related to regulation of radioactive 
materials are focused on protecting the general public from exposure to 
harmful levels of radiation (the Environmental Protection Agency), 
establishing emergency response procedures (the Department of 
Homeland Security), or preventing the illicit import of such materials 
(Customs and Border Protection, a component of the Department of 
Homeland Security). For example, the Environmental Protection Agency 
(EPA) is responsible for developing and implementing standards for 
protecting the general public from, among other things, radiation from 
contaminated air, water, and soil — whether this contamination is the by- 
product of industrial activities or occurred as a result of an accidental or 
deliberate release of radioactive materials. EPA sets cleanup standards for 
areas contaminated by radiation that consider the direct health effects and 
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the risks posed by very long-term exposure to even very low levels of 
radiation, which has the potential to increase the risk of developing cancer 
in the future. EPA is also responsible for establishing a comprehensive set 
of guidelines for use by local, state, and federal emergency services 
personnel and other first responders in the event of a release of 
radioactive material — such as that caused by an industrial accident or an 
RDD. The Department of Homeland Security (DHS) incorporates the 
radiation exposure thresholds, established primarily by EPA, into their 
guidance document, Application of Protective Action Guides for 
Radiological Dispersal Device and Improvised Nuclear Device Incidents. 
EPA's more general guidelines identify steps that should be taken to 
respond to and mitigate the effects of various types of radiological 
incidents — whether they are industrial accidents or terrorist attacks. 
Finally, DHS's Customs and Border Protection 5 (CBP) is responsible for 
preventing the smuggling of radioactive materials into the United States. 

In August 2003, we reported that (1) the number of radioactive sealed 
sources in the United States was unknown because NRC and agreement 
states tracked licenses, which can be issued for more than one source, 
rather than individual sealed sources; (2) despite concerns about the need 
for heightened security of radioactive sources, NRC had only recently 
issued requirements to improve the security of a relatively small number 
of the very largest sealed sources, used for irradiating food or medical 
supplies, leaving many others without increased security; and (3) there 
were potential security weaknesses in NRC and agreement state licensing 
processes. We made several recommendations to correct these problems, 
including that NRC (1) collaborate with agreement states to identify the 
types, amount, and availability of the highest-risk radioactive sources and 
the associated health and economic consequences of their malicious use; 
(2) re-examine its licensing procedures and requirements; and (3) work 
with states to devise and implement additional security measures, 
including performance measures to make sure any new measures are 
effective. 6 In addition, we reported in March 2006 that, among other things, 
CBP did not have access to NRC or agreement state licensing data, making 



°CBP is the unified border agency within DHS. CBP combines the inspectional workforces 
and broad border authorities of the former U.S. Customs Service, U.S. Immigration and 
Naturalization Service, Animal and Plant Health Inspection Service, and the entire U.S. 
Border Patrol. 

6 GAO, Nuclear Security: Federal and State Action Needed to Improve Security of Sealed 
Radioactive Sources, GAO-03-804 (Washington, D.C.: Aug. 6, 2003). 
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it difficult for officers at U.S. ports of entry to verify the legitimacy of 
shipments of radioactive sealed sources or materials. 7 Accordingly, we 
recommended that CBP and NRC develop a capacity to provide CBP 
border personnel with information needed to help determine if radioactive 
sealed source shipments are legitimate, including NRC licensing data. We 
also conducted two undercover operations to test CBP's and NRC's ability 
to prevent those with malicious intent from obtaining radioactive sources 
or from smuggling them into the United States. In March 2006, we reported 
on an undercover operation in which we used forged NRC documents to 
transport category 5 radioactive sources across the northern and southern 
borders of the United States, underscoring CBP's inability to verify the 
legitimacy of radioactive sources entering the United States. 8 In March 
2007, using the name of a fictitious business, we obtained a radioactive 
materials license from NRC, which we altered and then used to obtain 
commitments from private companies to purchase dangerous quantities of 
radioactive sources. 9 We did this only a few months after NRC had issued 
guidance designed to prevent those with no legitimate need to possess 
radioactive sources from acquiring a license. 

In this context, this report assesses (1) the progress NRC has made in 
implementing the recommendations in our August 2003 report, (2) other 
steps NRC has taken to improve its ability to monitor and track radioactive 
materials, (3) CBP's ability to detect radioactive materials at ports of entry 
on the northern and southern borders, and (4) CBP's ability to verify that 
such materials are appropriately licensed before they are allowed to enter 
the United States. 

To assess the progress NRC has made in implementing the 
recommendations in our August 2003 report, we reviewed NRC's periodic 
reports to the Congress on the status of these recommendations, reviewed 
the relevant policy and procedural changes undertaken since the report 
was issued, and interviewed NRC officials about the status of our 



7 GAO, Combating Nuclear Smuggling: DHS Has Made Progress Deploying Radiation 
Detection Equipment at U.S. Ports-oJ '-Entry, but Concerns Remain, GAO-06-389 
(Washington, D.C.: Mar. 22, 2006). 

8 GAO, Border Security: Investigators Successfully Transported Radioactive Sources 
across Our Nation's Borders at Selected Locations, GAO-06-545R (Washington, D.C.: Mar. 
28, 2006). 

9 GAO, Nuclear Security: Actions Taken by NRC to Strengthen Its Licensing Process for 
Sealed Radioactive Sources Are Not Effective, GAO-07-1038T (Washington, D.C.: 
July 12, 2007). 
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recommendations and actions taken and steps planned to implement 
them. We also spoke to various state regulators of radioactive sources and 
materials. We attended two annual meetings of the Organization of 
Agreement States and interviewed each of the board members to obtain 
their perspectives on NRC's implementation of the recommendations on 
issues affecting states. We also obtained documents and interviewed 
several experts at Sandia and Los Alamos National Laboratories in 
Albuquerque and Los Alamos, New Mexico, respectively, and Lawrence 
Livermore National Laboratory in Livermore, California, about the risks 
posed by RDDs. In addition, we met with officials from the National 
Nuclear Security Administration's Office of Global Threat Reduction, who 
are working on a classified, comprehensive analysis of the potential social 
and economic costs of various RDD scenarios. Finally, we obtained 
documents and interviewed officials from EPA about their responsibilities 
for developing and implementing standards for protecting the general 
public from radiation in contaminated air, water, and soil. 

To assess other steps NRC has taken to improve its ability to monitor and 
track radioactive materials, we obtained documentation about the 
capabilities, operations, and reliability of the NRC databases currently in 
operation and those in various stages of development. We also interviewed 
senior NRC database managers responsible for running or developing 
these systems. 

To assess CBP's ability to detect and verify the legitimacy of radioactive 
sealed sources and materials before they are allowed to enter the United 
States, we gathered documentation on the capabilities and operations of 
DHS's National Targeting Center, toured the facility, and interviewed the 
center's director. We gathered documents and interviewed CBP officials, 
including port directors and CBP line officers, during visits to a 
nonprobability sample 10 of several ports of entry on both the Canadian and 
Mexican borders. In addition, we gathered documentation about the 
operations of four other ports of entry and interviewed the principal CBP 
officials responsible for running these land border crossings. We selected 
these ports of entry because of their geographic locations and sizes, as 
well as the estimated volume of entries into the United States of both 
passengers and cargo (general and radioactive materials) at these 



10 Results from a nonprobability sample cannot be used to make inferences about a 
population because, in a nonprobability sample, some elements of the population being 
studied have no chance or an unknown chance of being selected as part of the sample. 
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locations. We also gathered information about the technical capabilities of 
the radiation detection equipment used by CBP officers. Finally, we 
interviewed officers of the Organization of Agreement States and other 
state officials to obtain the states' perspectives on their collaboration with 
NRC and DHS. We conducted this performance audit from August 2006 to 
May 2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 



RGSllltS in Brief NRC has implemented three of the six recommendations in our 2003 

lj - report on the security of radioactive sources by working with agreement 

states to (1) identify radioactive sealed sources of greatest concern, (2) 
determine how agreement state and nonagreement state officials could 
participate in the development and implementation of additional security 
measures for radionuclides of concern, and (3) include performance 
criteria for assessing NRC's and agreement states' implementation of these 
additional security requirements in periodic evaluations of both NRC and 
agreement state effectiveness. Specifically, NRC, working with DOE, 
developed a list of 16 radionuclides of concern that, if gathered in 
sufficient quantities, pose the greatest risk of being used by terrorists to 
make an RDD. Second, NRC, working with agreement states, has required 
several additional security measures called "increased controls" be taken 
to protect such radionuclides from theft, diversion, or other unauthorized 
access when they are gathered in quantities at or above a particular 
threshold. Increased controls include such measures as implementing 24- 
hour surveillance, multiple layers of physical security, and measures to 
ensure the immediate notification of local law enforcement agencies in the 
event of any actual or suspected breach in security. Finally, NRC and 
agreement states also established criteria for assessing the implementation 
of these increased controls and integrated these criteria into NRC's 
existing oversight program. To date, inspection teams comprised of 
inspectors from NRC (headquarters and regional office staff) and 
agreement states have assessed the implementation of increased controls 
by several agreement states and one of four NRC regional offices. 

In contrast, NRC has made limited progress toward implementing our 
recommendations to (1) modify its process for issuing licenses to ensure 
that radioactive materials cannot be purchased by individuals who have no 
legitimate need for them, (2) determine how to effectively mitigate the 
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potential psychological effects of malicious use of radioactive materials, 
and (3) re-examine whether certain radioactive sources should be 
regulated through specific licenses rather than general licenses. More 
specifically, although NRC did take steps in December 2006 that it thought 
would ensure that radioactive materials could not be purchased by those 
without a legitimate need for them, these changes were not sufficient to 
prevent us from obtaining an NRC license for a fictitious business and 
using this license to obtain commitments from manufacturers of industrial 
devices containing radioactive materials to sell them to us. Taken together, 
the devices we could have acquired would have contained a potentially 
dangerous quantity of one of the 16 radionuclides of concern. Moreover, 
NRC has not yet taken steps to determine how to mitigate the potential 
psychological effects of a terrorist attack using radioactive materials, 
although it has participated in an interagency working group that recently 
produced a draft version of a public education action plan that seeks, 
among other things, to reduce public fears of radioactivity and diminish 
the impact of a terrorist attack using such materials. Finally, although NRC 
has gathered the data it needs to re-examine whether certain radioactive 
sources should be regulated through specific licenses rather than general 
licenses, it has only recently begun the process of deciding, in consultation 
with agreement states, whether and what sort of changes should be made. 

Beyond responding to our previous recommendations, NRC has taken four 
steps to improve its ability to monitor and track radioactive materials 
since we issued our 2003 report. However, three of these efforts have 
limitations and are not yet implemented. More specifically, NRC created 
an interim national database to monitor all the licensed radioactive sealed 
sources that contain the more dangerous quantities (categories 1 and 2) of 
the types of radioactive sources that pose the greatest risk of being used in 
an RDD. This database, which relies on data that are updated annually, is 
intended to provide limited monitoring and tracking information on sealed 
sources until NRC can launch the National Source Tracking System. This 
system is intended to replace the interim database and provide more 
detailed, comprehensive, and frequently updated information on 
radioactive sealed sources. The National Source Tracking System will 
initially include information only about the potentially more dangerous 
category 1 and 2 radioactive sealed sources containing RDD-suitable 
radioactive materials, but will eventually include information on category 
3 and the largest category 4 sources which NRC also considers to be 
potentially dangerous. Also, this system has already been delayed by 18 
months and is not currently expected to be launched until January 2009. In 
April 2008, NRC announced plans to expand the National Source Tracking 
System to include category 3 and the largest category 4 sources by July 31, 
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2009 — a date which NRC told us the following month would slip to at least 
March 2010. NRC is also developing a Web-based system that will include 
information on all NRC specific licenses. This system is already more than 
3 years behind schedule, however, and may not include information, 
initially at least, on radioactive materials licenses that are issued by 
agreement states — which represent over 80 percent of all U.S. licenses for 
these materials. NRC officials told us that they are currently working with 
agreement states to determine the most efficient means of including 
agreement state data in the Web-based licensing system. Furthermore, 
NRC is in the early stages of developing a new, third system — a license 
verification system — which NRC officials hope to have operational by the 
time the Web-based licensing system is deployed in the summer of 2010, 
and will draw on information in both the National Source Tracking System 
and the Web-based licensing system to provide regulators and vendors 
with the ability to verify that those seeking to purchase additional 
radioactive sealed sources are licensed to do so. Taken together, these 
systems will include detailed information about what licensees are 
allowed to possess and, importantly, whether a prospective licensee 
seeking to purchase additional sealed sources is licensed to possess the 
additional types and quantities. The delays in the deployment and full 
development of both the National Source Tracking System and Web-based 
licensing system, and the new license verification system, are especially 
consequential because NRC has identified the deployment of these 
systems as key to improving the security of radioactive materials in the 
United States. 

While CBP has a comprehensive system in place to detect radioactive 
materials entering the United States at land borders, some equipment that 
is used to protect CBP officers is in short supply. More specifically, 
vehicles, cargo, and people entering the United States at most ports of 
entry along the Canadian and Mexican borders are scanned for radioactive 
materials with radiation detection equipment capable of detecting even 
very small amounts of radiation — whether these materials are in the form 
of industrial sources, raw materials, trace amounts of radiation found in 
such common products as ceramics or bananas, or radionuclides left in 
the human body in the aftermath of medical procedures. If radiation is 
detected, CBP officers must investigate until they are convinced that any 
vehicles, cargo, and people pose no threat. When CBP officers cannot 
resolve the radiation alarm with the information available to them at the 
border, they are required to contact technical experts at CBP's National 
Targeting Center for assistance. If radioactive materials are found, CBP 
officers must take steps to ensure that those seeking entry to the United 
States appear to have a legitimate reason to possess and transport such 
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materials, and are licensed as appropriate, before being allowed to enter 
the country. However, while CBP has comprehensive systems in place for 
detecting radiation, we found that personal radiation detectors — an 
important component of the suite of radiation detection equipment in 
place at the borders — are in short supply. Unlike other radiation detection 
equipment that is designed to be used as screening tools for radioactive 
materials, personal radiation detectors are designed to alert the individual 
wearer when he or she is being exposed to unusually high levels of 
radiation. While most CBP officers dealing with the public in front-line 
positions are equipped with personal radiation detectors, some are not. 
According to CBP officials, the agency lacks sufficient resources to 
purchase the approximately 1,500 personal radiation detectors it needs to 
provide one for each officer at the border who currently needs one. 

While CBP has systems in place to verify that all licenses for radioactive 
materials are legitimate, it has not effectively communicated its guidance 
to CBP officers on when they must contact the National Targeting Center 
to verify that radioactive materials are legitimately licensed. Consequently, 
some CPB officers are not following the most recent guidance, and some 
dangerous radioactive materials have entered the country without license 
verification. Specifically, according to a directive issued in 2003, there are 
circumstances when even large shipments of radioactive materials could 
be admitted without a CBP officer contacting the center to verify 
legitimacy. In 2006, to tighten security, CBP issued a supplemental 
memorandum revising the circumstances under which CBP officers are 
required to contact the National Targeting Center. That is, as of 2006, CBP 
officers must now contact the center to verify that radioactive materials 
are legitimately licensed whenever they detect more than incidental, trace 
amounts of radiation — for example, amounts higher than the low levels 
found in such common products as ceramics and bananas. However, 
headquarters has not effectively communicated this updated guidance to 
CBP officers at the border. When we asked CBP officers at several ports of 
entry about the current guidance for regulating the flow of radioactive 
materials across the border, almost all officers either provided us with the 
2003 directive or confirmed that the 2003 directive was current and 
operative; only one gave us guidance reflecting the 2006 memorandum. 
Finally, at one port of entry, CBP officers were confused about when to 
verify licenses and were routinely permitting large shipments of neutron- 
emitting material to enter the country. This situation was particularly 
troubling because (1) some neutron-emitting materials can be used to 
make nuclear weapons and (2) it has been CBP policy since 2003 to verify 
the legitimacy of all neutron-emitting materials. 
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We are recommending that the Chairman of the NRC take steps, consistent 
with sound systems development practices, to (1) ensure that priority 
attention is given to meeting the current January 2009 and summer 2010 
target dates for launching the National Source Tracking System, Web- 
based licensing system, and the new license verification system, 
respectively; and (2) complete the needed steps to include all potentially 
dangerous radioactive sources in the National Source Tracking System as 
quickly as is reasonably possible. In addition, to improve the likelihood of 
preventing radioactive sources and materials from being smuggled into the 
United States, we recommend that the Secretary of Homeland Security 
direct the Commissioner of CBP to (1) effectively communicate current 
CBP guidance to officers at ports of entry regarding when they are 
required to contact the National Targeting Center to verify the legitimacy 
of radioactive materials, and (2) take measures to ensure that this 
guidance is being followed. 

We provided a draft of this report to the Chairman of the NRC, the 
Secretary of Homeland Security, the Secretary of Energy, the 
Administrator of the EPA, and the Chair of the Organization of Agreement 
States for comment. NRC neither agreed nor disagreed with the report's 
findings and recommendations. Instead, NRC described its current efforts 
to implement the recommendations from our 2003 report and stated its 
intention to place the highest priority on the completion and deployment 
of the National Source Tracking System and the Web-based licensing 
system and a new, third system. Although we are encouraged by NRC's 
efforts to finish implementing the recommendations from our 2003 report, 
we remain concerned that nearly 5 years after we issued our report these 
recommendations have yet to be fully implemented. The other federal 
agencies that were offered the opportunity to comment on our report 
either agreed with our recommendations and outlined the steps to be 
taken to implement them, or chose not to comment on the final draft. 
Specifically, according to DHS's written comments, CBP concurred with 
our recommendations and specified the steps it will take to implement 
them. DOE and EPA reviewed and provided comments on earlier versions 
of our draft report and, after reviewing our final draft, had no further 
comments. The Organization of Agreement States neither agreed nor 
disagreed with our findings and recommendations, but offered comments 
on the quality of agreement state regulatory programs and NRC 
collaboration with agreement states, which we incorporated into the 
report. 
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NRC Has 

Implemented Three of 
the Six 

Recommendations 
from GAO's 2003 
Report 



Since 2003, NRC has worked with agreement states and others to identify 
the radioactive materials that pose the greatest risk of being used to make 
an RDD, established additional security measures for these materials, and 
taken steps to ensure the increased security measures are effectively 
implemented. However, NRC has not successfully corrected the 
weaknesses in its radioactive materials licensing processes. Further, NRC 
has taken limited steps to determine how to effectively mitigate the 
potential psychological effects of an RDD. Finally, NRC has not yet 
decided whether certain radioactive sources need stronger licensing 
requirements. 



NRC Has Worked with the 
States and Others to 
Identify Radioactive 
Sources That Pose the 
Greatest Risk of Being 
Used to Make an RDD 



An NRC and DOE working group had established a tentative list of 
radioactive materials under NRC license and DOE control and the 
quantities at which they pose the greatest risk. However, according to 
agreement states representatives, the agreement states were not directly 
involved in creating this list prior to the release of our August 2003 report. 
Our report recommended that the Chairman of NRC collaborate with the 
agreement states on this list, which NRC did before the list was finalized in 
August 2005. Specifically, in July 2002, the chairman of the NRC and the 
Secretary of Energy established a working group to identify radioactive 
materials according to the relative risk they posed of being used by 
terrorists to make an RDD. The working group assessed the relative 
hazards of various radioactive isotopes, taking into consideration both the 
nature of the materials (their potential threat to human health) and their 
attractiveness for use in an RDD (their half-lives, the quantities in which 
such materials are typically found, the level of protection typically 
surrounding them, and the ease with which they might be dispersed). The 
working group completed its initial study in November 2002 and issued a 
final report in May 2003. During this period, NRC, DOE, and other U.S. 
government entities were also negotiating with other countries under the 
auspices of the International Atomic Energy Agency (IAEA) to create a 
single international threshold quantity at which nations adopting IAEA's 
Code of Conduct would agree to take measures to more closely track and 
consider increased security measures to protect radionuclides of concern. 
NRC also consulted with agreement states on this issue. In the end, it was 
agreed in September 2003 that the threshold for increased concern — that 
is, the quantities at which various radionuclides become subject to more 
stringent security — should be category 2 quantities. 



After our August 2003 recommendation that NRC consult with the 
agreement states on this list, NRC officials formally provided it to 
agreement state officials for their review. The agreement states agreed 
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with the list and the thresholds developed by the IAEA and participating 
countries (see table 1). 



Table 1:16 Radionuclides of Concern 





Common 


Principal 

pmiQQinn/O 

CI 1 IIOOIUI 1^3^ 


Threshold for 
concern in curies 


Americium-241 


Am-241 


alpha 


16 


Americium-241 /Beryllium 


Am-241/Be 


alpha/neutron 


16 


Californium-252 


Cf-252 


alpha 


5.4 


Cesium-137 


Cs-137 


beta/gamma 


27 


Cobalt-60 


Co-60 


beta/gamma 


8.1 


Curium-244 


Cm-244 


alpha 


14 


Gadolinium-153 


Gd-153 


gamma 


270 


lridium-192 


lr-192 


beta/gamma 


22 


Plutonium-238 


Pu-238 


alpha 


16 


Plutonium-239/ Beryllium 


Pu-239/Be 


alpha/neutron 


16 


Promethium-147 


Pm-147 


beta 


1 1 ,000 


Radium-226 


Ra-226 


alpha 


11 


Selenium-75 


Se-75 


gamma 


54 


Strontium-90 (Yttrium-90) 


Sr-90 (Y-90) 


beta 


270 


Thulium-170 


Tm-170 


gamma 


5,400 


Ytterbium-169 


Yb-169 


gamma 


81 



Source: NRC. 

Note: NRC published the list of 16 radionuclides of concern in the Federal Register in 2007 as part of 
Orders Imposing Additional Security Measures. 



NRC also implemented our recommendations to (1) determine how 
agreement state and nonagreement state officials could participate in the 
development and implementation of additional security measures for 
radionuclides of concern and (2) include performance criteria for 
assessing NRC's and agreement states' implementation of these additional 
security requirements in periodic evaluations of both NRC and agreement 
state effectiveness. First, NRC worked with agreement states to devise and 
implement several additional security measures — called "increased 
controls" — to protect category 2 or greater quantities of radionuclides of 
concern from theft, diversion, and other unauthorized access. In late 2003, 
NRC and state officials, some of whom were also officers of the 
Organization of Agreement States or Conference of Radiation Control 
Program Directors (an organization that includes both agreement and 



NRC and Agreement States 
Have Established 
Additional Security 
Requirements and Taken 
Steps to Ensure Their 
Implementation 
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nonagreement states), established several working groups to facilitate the 
participation of state officials and their organizations in developing and 
implementing additional security measures for certain radioactive sources 
and materials. Several state officials, including a former chair of the 
Organization of Agreement States (OAS), told us that these working 
groups functioned in a highly collaborative and deliberative manner. 
Another OAS official told us that the fact that so many agreement state 
officials have been willing to volunteer to serve in working groups, and 
that NRC has been willing to provide some financial support for state 
officials' involvement, is a testament to the importance that both NRC and 
agreement states placed on federal-state collaboration. NRC and 
agreement states officially issued requirements for the increased controls 
in December 2005. The purposes of the increased controls, according to 
NRC, are to reduce the risk of unauthorized use of radioactive materials 
and to aid the prompt detection and assessment of and response to any 
such attempt. Increased controls include such measures as 24-hour 
surveillance, multiple layers of physical security, and measures to ensure 
the immediate notification of local law enforcement agencies in the event 
of any actual or suspected breach in security. For example, increased 
controls on medical sources require some sources to be kept in heavily 
secured rooms with limited access (see fig. 1). 
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Figure 1: Cesium-137 Sources at a Hospital Used for Cancer Treatment Are Kept in 
a Secure Room with Limited Access 




Source: GAO. 



According to NRC, all increased controls were to be fully implemented by 
June 2006. Some licensees with the highest-risk sources were inspected by 
June 2007, while all increased controls must be fully inspected by June 
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2009. NRC regional offices and agreement state regulators are also 
currently in the process of reaching out to licensees to help ensure they 
will be able to meet the June 2009 deadline and have already performed 
preliminary increased controls inspections on approximately 1,100 of the 
1,700 licensees subject to the new controls (see table 2). 



Table 2: Increased Controls on Category 2 or Greater Quantities of the 16 
Radionuclides of Concern 



Control 



General purpose 



Access controls 



Control access to high-risk materials at all 
times. 



Background checks for unescorted 
access 



Limit unescorted access only to those 
determined to be trustworthy and reliable after 
background checks. 



Monitor, detect, and respond to 
unauthorized access 



Ensure the establishment of the means to 
monitor and immediately detect and respond to 
any unauthorized access. 



Advance coordination with local law 
enforcement 



Response plans must include advanced 
cooperation with local law enforcement 
agencies, and any actual response must 
include this local law enforcement agency. 



Transportation controls 



Additional security measures are required for 
shipments of category 1 and 2 sources. 



Protection of sensitive physical plant 
information 



Protecting security related information against 
unauthorized disclosure by limiting access to 
trustworthy and reliable individuals with a need 
to know. 



Source: NRC. 



Agreement state officials told us that they have already prevented at least 
one attempted theft of an industrial radiography source typically used to 
inspect metal parts and welds for defects. The would-be thieves broke in 
to an area protected by an alarm system that had been recently installed 
by the licensee to comply with the new requirement mandating the 
capacity to monitor, detect, and respond quickly with local law 
enforcement in the event of any unauthorized access. This new alarm 
system immediately notified local law enforcement authorities, who 
responded in time to prevent the criminals from obtaining an iridium-192 
radiography source — a potent gamma emitter that could cause extensive 
radiation burns if handled improperly. 

NRC and agreement states have also collaborated in establishing criteria 
for assessing the implementation of increased controls and integrated 
these criteria into NRC's existing oversight program, the Integrated 
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Materials Performance Evaluation Program (IMPEP). 11 In March 2006, 
NRC established performance criteria devised in working groups with 
agreement state officials for evaluating the implementation of increased 
controls. Under each of the existing performance categories — staffing and 
training, the technical quality of inspections, licensing actions, incident 
and allegation activities, and the overall status of the materials inspection 
program — NRC added additional performance criteria. For example, NRC 
regional and agreement state programs are now evaluated on whether they 
have established a system to readily identify new licensees that should be 
subject to increased controls and to determine whether sensitive licensee 
information is being securely maintained. Although not all NRC regional 
and agreement states' radioactive materials programs have been evaluated 
on their implementation of the increased controls, 22 of the 35 agreement 
states and one of the three NRC regional offices with responsibilities for 
regulating such materials have to date had aspects of their implementation 
of increased controls at least partially assessed in this manner. Moreover, 
agreement state officials familiar with this revised performance evaluation 
process told us that the new criteria were effective and valid measures of 
the implementation of the increased controls. 



To increase the security of radioactive materials and sealed sources and 
better ensure that they are used as intended, we recommended in 2003 
that NRC modify its process for issuing specific licenses to ensure that 
such sources cannot be purchased before NRC has verified, through 
inspection or other means, that the materials and sources will be used as 
intended. In December 2006, NRC issued new prelicensing guidance to 
help NRC and agreement state licensing officials to make a risk-based 
determination of whether an applicant for a license to possess an amount 
of radioactive material or source sufficient to require a specific (rather 
than a general) license should have to undergo some sort of verification 
before being granted a license. This guidance asked two screening 
questions: (1) whether "the applicant is an entity or a licensee transferring 
control to an entity that has never had a license or is unknown" and (2) 



NRC implemented IMPEP in 1995 to evaluate NRC's regional materials program and the 
agreement state radiation control programs using evaluation criteria, known as 
performance indicators, to ensure consistency in the nation's materials safety program. 
Reviews are conducted jointly by the Office of Federal and State Materials and 
Environmental Management Program staff, with agreement state and regional 
representatives usually on the team. Approximately 10 to 12 reviews are scheduled each 
year. NRC regions are normally reviewed every 2 years, and agreement states every 2 to 4 
years — the timeline may be adjusted depending on past performance. 



Weaknesses Persist in 
NRC's Materials Licensing 
Process 
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whether the applicant is seeking category 2 or greater quantities of one or 
more of the 16 radionuclides of concern and has not already been licensed 
to possess materials subject to a security order or additional requirements 
for increased controls. If the applicant answers yes to either question, 
according to the guidance, the license examiner should consider whether 
it is necessary to take any of the steps on a 12-item checklist. For example, 
one checklist item suggests doing an Internet search on the name of the 
applicant; another suggests conducting a site visit to the stated place of 
business. In spring 2007, however, our investigators, posed as first-time 
radioactive materials license applicants for devices containing sources 
large enough to require specific licenses, and therefore subject to the extra 
scrutiny from the 12-item checklist, they were able to obtain a materials 
license from NRC, even though an Internet search or a prelicensing site 
visit would have revealed the application to be based on false claims. 12 
After being notified of the results of our undercover investigation in June, 
NRC stopped issuing specific licenses for radioactive materials and 
sources until it could develop and issue "supplemental interim 
prelicensing guidance." This supplemental guidance, issued 12 days after 
NRC stopped issuing specific licenses, requires a first-time licensee to pass 
a site visit inspection at the applicant's place of business or appear at an 
NRC regional office for a face-to-face meeting with a license application 
reviewer and satisfy this official that the radioactive materials will be used 
as intended. Applicants would not be subject to these requirements if they 
already have an established regulatory relationship with NRC or an 
agreement state and meet other specific criteria. 

In September 2007, NRC announced in a public briefing that it had 
developed a comprehensive plan for resolving all the vulnerabilities in its 
radioactive materials licensing processes. NRC announced plans to do 
several things to help make its program more secure, including the 
following. 

• Establish a panel of independent external reviewers to study NRC's 
materials licensing program vulnerabilities, with particular scrutiny of its 
"good faith assumptions" about applicants. This panel presented a number 
of observations and recommendations to NRC in March 2008. 



GAO investigators made a similar application for a radioactive materials license to an 
agreement state but withdrew the application when the agreement state official informed 
GAO investigators that it would require a site visit to the applicant's place of business — a 
step that would have revealed the application not to be authentic. 
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• Reconstitute the NRC and agreement state prelicensing working group to 
develop solutions to vulnerabilities associated with verification, 
counterfeiting, and general licenses. 

• Establish a new materials program working group that would review the 
results of an independent external review and comprehensively assess the 
entire materials licensing program, including NRC's evaluation of state 
programs. 

• Leverage the capabilities of new databases currently under development — 
the National Source Tracking System and Web-based licensing. 

To assure themselves that other radioactive materials licenses had not 
been issued to fraudulent individuals, NRC also undertook a retrospective 
review of a sampling of licenses to verify their legitimacy. NRC officials 
stated that these reviews uncovered no other incidences of fraud. We 
think all of these actions are useful steps toward closing the long-standing 
vulnerabilities in NRC materials licensing processes, but it is too early to 
evaluate whether these steps will be successful. 



In addition to recommending that NRC work with agreement states and 
others to identify and better secure the radioactive sources that pose the 
greatest risk of being used to make an RDD, we also recommended that 
NRC determine how to effectively mitigate the potential psychological 
effects of malicious use of radioactive materials. Since we issued our 2003 
report, DHS issued the National Response Plan in December of 2004 to 
establish a comprehensive all-hazards approach to domestic incident 
management. The National Response Plan, revised and reissued as the 
National Response Framework in January 2008, details how federal 
agencies and others should coordinate to ensure an efficient and effective 
nationwide response to a broad spectrum of domestic incidents, including 
those involving the malicious use of radioactive materials. Under the 
National Response Framework, where a radiological incident involves 
facilities or materials licensed by the NRC or agreement states, NRC either 
coordinates federal response activities or assists DHS in doing so, 
depending on the scope of the incident. 13 In our view, such coordination 
should include taking actions to determine how to effectively mitigate all 
the effects of such an RDD — including psychological effects. 



See National Response Framework, "Emergency Support Function #10-Oil and Hazardous 
Material Response," p. 14, and Nuclear/Radiological Incident Annex, p. NUC-3 and table 1. 



NRC Has Taken No 
Significant Actions to 
Mitigate the Potential 
Psychological Effects of an 
RDD 
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However, NRC has not implemented this recommendation because, 
according to NRC officials, NRC has only a very limited role to play in 
mitigating the psychological effects that may occur in the aftermath of an 
RDD event unless the amount of radioactive materials released is 
sufficient to cause "prompt fatalities" — that is, fatalities directly caused by 
exposure to radioactive materials. Accordingly, NRC has identified and 
taken limited steps that it sees as consistent with its prescribed role. 
Specifically, NRC points to its participation in the interagency Radiation 
Source Protection and Security Task Force Public Education Working 
Group with DHS, DOE, agreement and nonagreement states, and others to 
design a coordinated public education campaign to, among other things, 
reduce public fears of radioactivity and diminish the impact of a terrorist 
attack using radioactive materials. This working group issued a draft 
public education action plan in December 2007 and provided an update on 
its efforts on May 15, 2008. NRC is also a member of and has provided 
input to a Health Physics Society 14 working group that is putting together a 
program to educate the public about radiation and help counteract 
unfounded or irrational fears. 

Despite these activities, in our view, NRC's response to our 
recommendation is inadequate. Over 4 years after we made our 
recommendation, NRC has not yet determined how to effectively mitigate 
the potential psychological effects of the malicious use of radioactive 
materials. Moreover, according to existing EPA protective action 
guidelines, the amount of radioactive material needed to cause "prompt 
fatalities" — the threshold at which NRC accepts having a significant role — 
is significantly greater than would be necessary to cause contaminated 
areas to be evacuated, a threshold at which psychological effects could 
reasonably be expected to occur. According to NRC officials, unless the 
prompt fatalities threshold is met, NRC believes its job is to provide the 
public with prompt, complete information about the effects of any release 
of radiation involving material the agency regulates and, to the extent it is 
relevant, to inform the public about the NRC regulations or guidance that 
may be relevant as a result. Beyond participating in an interagency task 
force working group, providing any additional information that may be 



The Health Physics Society is a scientific and professional organization whose members 
specialize in occupational and environmental radiation safety. The society supports its 
members in the practice of their profession and also, among other things, promotes public 
information preparation and dissemination, education and training opportunities, and 
scientific information exchange through conferences and meetings, 
http://hps.org/aboutthesociety/ (accessed April 17, 2008). 
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needed is, according to NRC, the responsibility of others (federal, state, or 
local officials, etc.)- This approach is consistent with NRC's view that its 
primary responsibility is to regulate "inside the fence, inside licensee- 
controlled areas." "Outside the fence," NRC views its role as assisting 
those federal agencies that have primary responsibility, namely DHS, DOE, 
and others and making sure that its licensees comply with these agencies' 
legitimate concerns. 



NRC Has Not Yet Decided 
Whether Certain 
Radioactive Sources Need 
Stronger Licensing 
Requirements 



In light of growing concerns about the potential malicious use of 
radioactive sealed sources, and to better secure generally licensed devices 
containing such sources, we recommended that NRC, in consultation with 
agreement states, re-examine whether certain radioactive sources should 
be regulated through specific licenses rather than general licenses. 
According to NRC, by November 2007 it had gathered the necessary 
information about generally licensed devices containing relatively larger 
radioactive sources (the largest category 4 sources or higher) to decide 
whether changes should be made. 15 NRC and agreement state officials are 
currently analyzing the data and conferring in working groups and, 
according to NRC officials, initiated a rulemaking process in September 
2007. Given the complexity and range of the issue and the solutions to be 
considered, NRC officials estimate the formal rulemaking process will take 
approximately 2 years, depending on what form a new rule takes. Rules 
that require states to make statutory changes typically take longer to 
implement. NRC officials stressed that it is impossible to predict what 
form a final rule would take. The various options — for example, a lower 
activity cap for general licenses; specific licensing requirements for 
particular radionuclides regardless of activity; or the development of a 
new, more streamlined specific license — will continue to be a subject of 
discussion among federal and state radioactive materials regulators until a 
decision has been reached. If a revised rule is finalized by September 2009, 
agreement states could have up to an additional 3 years to fully implement 
any changes — meaning that any rule change may not be fully implemented 
until the fall of 2012. 



15 NRC has gathered information from licensees of category 1 through 3 and the most 
dangerous category 4 sources. Under the IAEA categorization scheme, any source 
containing category 3 or greater quantities of radioactive materials could be dangerous to 
human health if not handled properly. 
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NRC Has Improved Its 
Ability to Monitor and 
Track Radioactive 
Sealed Sources, but 
New Systems Have 
Been Delayed 



NRC has developed an interim database that can monitor and track the 
more dangerous, category 1 and 2 radioactive sealed sources. However, 
two additional systems — one to track radioactive sealed sources and one 
to track licenses — have been repeatedly delayed. A third system under 
development will draw on information in both of these systems to provide 
regulators and vendors with the ability to verify that those seeking to 
purchase radioactive sources are licensed to do so. 



NRC Created an Interim 
National Database to 
Better Monitor the More 
Dangerous Radioactive 
Sealed Sources 



NRC established the interim database in October 2003 to provide NRC and 
agreement states a stop-gap means of more closely monitoring the 
potentially more dangerous sources until the new National Source 
Tracking System (NSTS) could be completed. This database is called 
"interim" because it is intended to be a temporary measure for 
implementing a quick, practical response to the recommendation in the 
May 2003 DOE-NRC report on RDDs that the U.S. government develop a 
database of sources at greatest risk of being used to make an RDD. The 
interim database currently records information about category 1 and 2 
radioactive sealed sources licensed by both NRC and agreement states. 16 
For a given source, the interim database records the radionuclide; the 
quantity (activity); the licensee address; and the make, model, and serial 
number (where available) of the registered source. Although participation 
is voluntary, NRC successfully persuaded agreement states to provide data 
on their licensees for inclusion in the interim database, and as a result, the 
database includes information from 99 percent of all licensees. Originally, 
the database was intended to be a one-time snapshot of what radioactive 
materials existed in the United States during fiscal year 2004. However, 
NRC began to update the database annually as it became apparent that the 
development and launch of the NSTS would take longer than expected. 
The result is an annual snapshot of information about radioactive sources 
as they were at one point during a given year, not a system that tracks the 



During the first year of the interim database, information on some category 3 sources that 
were aggregated in quantities large enough to be considered a category 2 quantity were 
also recorded. However, the difficulty in defining what constituted collocated/aggregated 
or separate sources made recording aggregated category 2 quantities extremely difficult 
and such information was no longer collected after the first year of implementation. For 
example, keeping a larger number of category 3 sources divided among locked barriers of a 
certain security level may allow some such material at the same facility not to be reported 
as collocated and not subject to the aggregation rules that would require it to be reported 
as a category 2 quantity. 
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current location of sources. The information for any given source in the 
database is, at any given time, to 12 months old. 

It is important to note that the licensee address listed in the interim 
database may simply be the address for the licensee's administrative 
offices — that is, the place where the company officials responsible for 
dealing with NRC or state regulators have offices — and not necessarily the 
address of the physical location of the material. A licensee may be allowed 
to store radioactive materials in several locations throughout one or more 
states but still provide only a single administrative address for reporting 
purposes in the interim database. NRC and agreement states check the 
completeness and accuracy of this inventory of source locations during 
routine inspections of licensees. 



New Systems to Track 
Radioactive Sealed 
Sources and Licenses Have 
Limitations and Have Been 
Repeatedly Delayed 



The completion and implementation of the major new systems NRC is 
developing to help it better track, and ultimately help secure, radioactive 
sealed sources have been delayed repeatedly. The impetus for the creation 
of the NSTS was a recommendation in the May 2003 DOE-NRC report on 
RDDs that radionuclides identified as being at greatest risk of use by 
terrorists to make an RDD be nationally tracked. The Energy Policy Act of 
2005 required the establishment of a mandatory tracking system. 17 The 
NSTS is also consistent with the United States' endorsement of the IAEA 
Code of Conduct, which recommends that nations establish a national 
source registry to include, at a minimum, category 1 and 2 sources of 
radionuclides of concern. 



The NSTS will initially track category 1 and 2 sources of the 20 
radionuclides that NRC has determined are sufficiently attractive for use 
in an RDD or for other malicious purposes that warrant national tracking. 
The 20 radionuclides include the 16 radionuclides of concern plus four 
additional radionuclides: actinium-227, polonium-210, and thorium-228 and 



'An NRC rale creating the NSTS and certain provisions for the system are required by the 
Energy Policy Act of 2005. The final rule (issued under NRC's authority to regulate 
radioactive materials for public health and safety, an authority shared with the agreement 
states) requiring that licensees report to the NSTS and requiring the issuance of unique 
source serial numbers was published in the Federal Register on November 8, 2006. NRC 
has since modified the rale and now requires reporting to the NSTS by January 31, 2009. 
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-229. 18 In April 2008, NRC proposed a rule to expand the NSTS to include 
all category 3 sources and the largest category 4 sources (at or about one- 
tenth of the activity threshold for category 3). Although the NSTS was 
originally supposed to be operational in mid-2007, difficulties in 
developing the system have led NRC to postpone the launch of the NSTS 
multiple times. NRC's current estimate for the launch of the NSTS 
(tracking category 1 and 2 sources) is January 31, 2009. NRC estimates the 
expansion of the NSTS will be implemented by March 2010. 

According to NRC, the NSTS will initially be populated by the data from 
the interim database. However, unlike the interim database, the NSTS will 
not be an annual snapshot of source inventories. The NSTS will be a 
transaction-based system that will track each major step that each tracked 
radioactive source takes within the United States, from "cradle to grave." 
That is, licensees will be responsible for recording the manufacture, 
shipment, arrival, and disposal of all licensed and tracked category 1 and 2 
radioactive sources. More specifically, the NSTS will include the 
radionuclide, quantity (activity), 19 manufacturer, manufacture date, model 
number, serial number, and site address. The licensee will have until the 
close of the next business day after a transaction takes place to enter it 
into the system. As a result, the location of all such sources will be 
accounted for and more closely tracked than in the interim database. 
While some sources may be moved temporarily to different sites, any time 
that the source changes its "home base," the transaction must be 
registered through the NSTS. In this way, the data in the system should be 
kept up-to-date. 

For security reasons, access to the information in the NSTS will be on a 
need-to-know basis. Licensees will have access to information about their 
sources, agreement state officials will have access to information about 
licensees and sources in their state, and only selected NRC officials will 
have access to the entire system. 



NRC opted to include these four additional radionuclides that NRC deems of concern for 
RDD purposes in the NSTS at DOE request. Although NRC and agreement state licensees 
do not possess large numbers of sources containing these radionuclides, and none with 
category 2 or higher quantities, DOE might. 

19 The activity data for a given source may be reported as of the manufacture date or assay 
date. Because all radioactive materials decay over time, an up-to-date estimation of the 
activity level will be calculated, if needed, by the system. 
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While the NSTS is designed to track larger and potentially more dangerous 
radioactive sealed sources, NRC's Web-based licensing system is being 
developed to provide quick access to up-to-date information on all NRC 
specific licenses for radioactive materials and sources in all five IAEA 
categories. In its technical comments on a draft of this report, NRC told us 
that it is developing a third system — a license verification system — which, 
once operational, will draw on the information in NSTS and the Web-based 
licensing system which will provide regulators and vendors of radioactive 
sources with an easily accessible ability to verify that those seeking to 
purchase nationally tracked sources are licensed to do so. Taken together, 
these systems will include detailed information about what licensees are 
allowed to possess and, importantly, whether a prospective licensee 
seeking to purchase additional sealed sources is authorized to possess the 
additional types and quantities. For example, an individual from a 
construction company wanting to purchase a piece of equipment 
containing a radioactive sealed source must demonstrate to the vendor 
that the company is licensed to possess such a source. Once all three 
systems are operational, the vendor could easily verify that the company is 
legitimately licensed to purchase a given piece of equipment containing 
the particular sealed source. Although the Web-based licensing system was 
originally supposed to be deployed in 2005, it is now estimated be 
completed no earlier than the late summer of 2010. Moreover, the Web- 
based licensing system may not initially include any information on 
radioactive materials licenses issued by agreement states — which 
represent over 80 percent of all U.S. licenses for these materials. NRC 
officials told us that they are currently working with agreement states to 
determine the most efficient means of including agreement state data in 
the Web-based licensing system. Finally, NRC has only recently begun 
developing its new license verification system and has not yet established 
firm completion dates. However, NRC officials told us that they expect it 
to be complete by the time that the Web-based licensing is launched. 

The delays in the development of both the NSTS and the Web-based 
licensing system are especially consequential because NRC officials, both 
commissioners and staff, have identified the deployment of these systems 
as key to improving the control and accountability of radioactive materials 
in the United States. More specifically, in NRC's September 2007 public 
hearing addressing the weaknesses that we uncovered in NRC's materials 
licensing program, the commissioners said that an expanded NSTS 
including category 3 and perhaps the largest category 4 sources, a Web- 
based licensing system including agreement state data, and some means 
for making relevant information in both of these systems available to 
vendors and officials at ports of entry, would be a secure and effective 
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means of verifying that those seeking to obtain radioactive materials, or 
enter the United States with licensable quantities of radioactive materials 
or sources, were doing so for legitimate purposes. 



CBP Has a 
Comprehensive 
System for Detecting 
Radiation at Ports of 
Entry on the Northern 
and Southern Borders 



CBP has a comprehensive, layered system for detecting and identifying 
radioactive materials as they enter the United States at land ports of 
entry — whether they are in the form of industrial sources, raw materials, 
trace amounts of radiation found in such common products as ceramics or 
bananas, or radionuclides left in the human body in the aftermath of 
medical procedures. However, some equipment that is used to protect 
CBP officers is in short supply. 



CBP's Radiation Portal 
Monitors Scan Most 
Vehicle, Cargo, and 
Passenger Traffic Entering 
the United States 



According to CBP, over 90 percent of the personally owned vehicles 
entering the United States at land ports of entry pass through radiation 
portal monitors. 20 Portal monitors are very sensitive and can detect even 
the very small amounts of radiation. All vehicles must pass through the 
monitors at every port of entry that deploys them. Any vehicle triggering a 
portal monitor alarm is referred to a secondary screening area, where it is 
sent through a second portal monitor to confirm (or disconfirm) the 
original alarm. Whether the second portal monitor confirms the alarm or 
not, the vehicle, the driver, any passengers, and any cargo are scanned by 
a CBP officer with a hand-held radiation isotope identification device 
(RIID). The RIID can detect very small amounts of radiation and also 
identify many of the most commonly used radionuclides by name and 
activity level. CBP keeps detailed records on the cause of each alarm and 
its resolution and sends them to a central location for archiving. All portal 
monitor alarms must be resolved — that is, CBP officers must investigate 
each alarm until they are convinced that the vehicle, occupants, and any 
cargo pose no threat and, if radioactive materials are found, that the 
vehicle occupants appear to have a legitimate reason to possess and 
transport them — before the vehicle, driver, and any passengers can be 
allowed to enter the United States. 



According to CBP officials, 91 percent of all personal vehicles arriving in the United 
States are scanned by radiation portal monitors. In addition, 100 percent of truck cargo 
arriving from Mexico and 91 percent arriving from Canada are scanned by portal monitors. 
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The vast majority of portal monitor alarms are resolved by CBP officers at 
the border using the information available to them directly from portal 
monitor and RIID scans, documents provided by shippers and passengers, 
and the explanations of the travelers (commercial and passenger vehicle 
drivers and passengers) for why they are carrying radioactive materials, 
whatever the amount or form. When CBP officers cannot resolve the 
radiation alarm with information available to them at the border, they are 
required to contact technical experts at CBP's National Targeting Center 
for assistance. These experts offer scientific expertise to help CBP officers 
interpret and use the portal monitor and RIID data and will also verify 
whether any radioactive sources have been properly licensed by checking 
NRC and agreement state licensing data. 21 Figures 2 and 3 show vehicles 
lining up and passing through portal monitors at ports of entry. Figure 4 
shows an inspection area and a truck-sized portal monitor on the southern 
border. 



NRC provides the National Targeting Center with up-to-date information concerning the 
licensing, import, and export of all regulated radioactive materials and sources in the 
United States. This cooperation gives CBP indirect access to NRC and agreement state 
licensing databases; NRC's list of licensees authorized to import or export radioactive 
materials and sources; and advanced notification of large, category 1 radioactive materials 
shipments. 
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Figure 2: Passenger Vehicles at a Port of Entry on the Southern Border 




Source: GAO. 
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Figure 3: Trucks Passing through Portal Monitors on the Northern Border 




Source: GAO. 
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Figure 4: Truck-Sized Portal Monitor in the Inspection Area at a Port of Entry on the 
Southern Border 




Source: GAO. 



Most of the CBP officers we spoke with at the ports of entry we visited 
told us they had never or rarely felt it necessary to contact the National 
Targeting Center for assistance, but they all stated that they would not 
hesitate to do so if they encountered anything out of the ordinary or if they 
thought something might pose any threat to national security. Those CBP 
officers who told us they had contacted the center for assistance were 
very pleased with the timely and practical help they received. 
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Some Radiation Detection Finally, we found that personal radiation detectors — an important 
Equipment Is in Short component of the suite of radiation detection equipment at the borders — 

Supply are ^ snor t su PPly- Unlike portal monitors and RIIDs, personal radiation 

detectors are not designed to be used as screening tools for radioactive 
materials. Instead, they are designed to alert the individual wearer when 
he or she is being exposed to unusually high levels of radiation, permitting 
CBP officers to take protective measures if needed. While most CBP 
officers dealing with the public in frontline positions are equipped with 
personal radiation detectors, some are not. According to CBP officials, the 
agency lacks sufficient resources to purchase the approximately 1,500 
personal radiation detectors it needs to provide one for each officer at the 
border who currently needs one. In fact, during our visit to one port of 
entry, we found that some officers in frontline positions at the border did 
not have a personal radiation detector. Moreover, CBP has no money 
currently in the budget to acquire the approximately 2,000 additional 
personal radiation detectors it would require to equip the new officers it 
plans to hire — leaving a shortfall of about 3,500 personal radiation 
detectors. CBP headquarters officials are aware of the shortage of 
personal radiation detectors and they hope to procure enough of them for 
each officer who needs one. However, they acknowledged that, in doing 
so, they have to consider competing priorities at the border, and also 
whether emerging technologies may provide a more effective solution. 



CBP Guidance on 
When to Verify 
Licenses for 
Radioactive Materials 
Entering the United 
States Was Not 
Communicated to the 
Field 



In December 2003, CBP issued a radiation detection program directive that 
contained, among other things, the requirement that CBP officers at the 
border contact the National Targeting Center for assistance under certain 
circumstances when radiation is detected. Under the directive, even large 
shipments of radioactive materials can be admitted without a CBP officer 
contacting the National Targeting Center to verify whether the materials 
are legitimately licensed. The radiation detection program directive was 
scheduled for review in December 2006, but CBP officials told us that this 
review was delayed pending the resolution of unrelated matters regarding 
the CBP's right to search property for radioactive materials between ports 
of entry. 

In response to our March 2006 reports 22 assessing the progress DHS has 
made deploying radiation detection equipment at U.S. ports of entry and 
detailing how our investigators used fake documents to bring licensable 
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quantities of industrial radioactive sources into the United States 
respectively, CBP revised its policy. Specifically, in May 2006, CBP issued 
a memorandum that officials told us tightened security by requiring CBP 
officers to contact the center to verify the legitimacy of a license or obtain 
technical assistance whenever they detect more than incidental, trace 
amounts of radiation, such as that found in ceramics and bananas or in 
people who have recently undergone a medical treatment using 
radionuclides. This memorandum, according to headquarters officials, was 
intended to communicate to officers at the border that they should verify 
the legitimacy of radioactive materials because CBP officers at a port of 
entry cannot determine whether a licensee or shipper is authentic without 
the assistance of the National Targeting Center. 

This updated guidance, however, was not effectively communicated to 
officers at the border. Specifically, we asked border officials at the several 
ports of entry we visited and the four others we interviewed on the 
telephone about the current guidance they use for regulating the flow of 
radioactive materials across borders. All either provided us copies of the 
2003 radiation detection program directive or confirmed it was current 
and operative, and some gave us versions of the directive that were port- 
specific, and therefore, more detailed. Only one port of entry provided us 
with guidance reflecting the May 2006 memorandum and its requirement 
that CBP officers contact the National Targeting Center to verify the 
legitimacy of all licensable quantities of radioactive materials crossing the 
border. Moreover, officials at all these ports of entry told us that they 
contact the National Targeting Center for technical assistance when they 
need it; officials at only one port of entry told us they would call solely to 
verify whether radioactive materials are appropriately licensed. Officials 
representing a few other ports of entry told us they had never called the 
National Targeting Center to verify the legitimacy of a license and that all 
of their inquiries had been made solely to seek technical assistance. 

In addition, the officers we spoke to had minimal knowledge of the general 
regulatory structure established by NRC and agreement states. While we 
found officers generally were aware that radioactive materials and sources 
must be licensed, they typically did not take steps to verify licenses, as 
required by the May 2006 guidance. At the ports of entry we visited, we 
observed CBP officers working to ensure that when radioactive materials 
triggered an alarm, the people carrying (or contaminated with) these 
materials had a good explanation and that the readings from the portal 
monitors and RIIDs were in accord with what travelers said and what their 
documents attested to. In short, the officers were focused on resolving the 
alarm according to the rules established in the 2003 radiation detection 
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program directive and on attending to the many other tasks they have in 
monitoring what flows through U.S. land ports of entry. 

In fact, the approach to resolving radiation alarms according to the 
procedures prescribed in the 2003 radiation detection directive has been 
so ingrained in day-to-day practice at one port of entry that CBP field 
office managers had discovered only in the week before our visit that 
officers had been allowing large neutron radiation-emitting shipments to 
enter the United States without contacting the National Targeting Center 
for technical support and to verify their legitimacy. While this situation has 
since been corrected, this is of particular concern because (1) some 
neutron radiation-emitting materials can be used to produce nuclear 
weapons and (2) it is in direct conflict with CBP's 2003 directive and 2006 
supplemental guidance. 

A senior CBP headquarters official told us that the 2003 radiation 
detection program directive, as supplemented by the additional criteria 
established by the May 2006 memorandum on when CBP officers must call 
to verify the legitimacy of radioactive materials, reflected current policy. 
He told us that the May 2006 memorandum was always envisioned as only 
an interim solution, pending a revision of the directive. According to this 
official, CBP was still working on a revision to the directive that would 
fully incorporate the heightened security of the memorandum — but he 
could not give a firm date when an updated directive would be issued. In 
our view, until CBP effectively communicates the guidance in the 2006 
memorandum to its border locations, CBP officers at the border will not 
know when they should contact the National Targeting Center to verify 
that radioactive materials being brought into the United States are 
legitimately licensed. 



NRC has taken a number of important actions to implement several of our 
recommendations from our 2003 report that will enhance the 
accountability and control of radioactive sources and materials and its 
ability to help protect the nation from nuclear smuggling. Still, its actions 
in three key areas remain incomplete. In our view, the reasons behind our 
recommendations 4 years ago are still valid today. Accordingly, to further 
enhance public protection from the threats posed by potentially dangerous 
quantities of radioactive sealed sources and materials, we continue to 
believe that NRC should implement the recommendations from our 2003 
report. Specifically, NRC should 



Conclusions 
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• correct the vulnerabilities uncovered in NRC's materials licensing 
process and implement the steps needed to ensure that radioactive 
materials can only be purchased by those with a legitimate reason to 
possess them, and 

• determine whether certain radioactive sources should be regulated 
through specific licenses rather than general licenses and move quickly 
to implement whatever changes are deemed necessary. 

In addition, we continue to believe that a plan of how to effectively 
mitigate the potential psychological effects of an RDD event needs to be 
developed. For potential incidents involving radiological facilities or 
materials licensed by NRC or agreement states, for which NRC has 
coordinating responsibilities, NRC should work with DHS, other federal 
agencies, and agreement states, respecting the roles described in the 
National Response Framework, to take action to determine how to 
effectively mitigate the potential psychological effects of such an event. 

Also, the causes of the delays in the development and implementation of 
NRC's more comprehensive systems for securing, monitoring, and tracking 
radioactive materials need to be confronted and addressed. Specifically, 
NRC's National Source Tracking System and Web-based licensing system 
have missed numerous milestones and are not expected to be complete as 
currently envisioned until at least 2010. Past delays in implementing these 
systems give reason to wonder whether these dates will again be extended 
and whether NRC is firmly committed to delivering these systems. The 
recent decision to develop a third new system has added to these 
concerns. In our view, given the potential consequences of the use of these 
materials in an RDD and the potential for these systems to greatly improve 
the security of both NRC's and agreement states' materials licensing 
processes, it is time for NRC to make meaningful progress in successfully 
completing these important initiatives. 

While CBP has a comprehensive system in place to detect radiation at 
ports of entry on the northern and southern borders, CBP's task of 
preventing the smuggling of radioactive materials is made more difficult by 
the fact that guidance on when officers should verify whether radioactive 
materials being brought into the United States are legitimately licensed has 
not been effectively communicated. The result of this communication gap 
is that resources that are available to CBP officers at the border to ensure 
that those possessing radioactive materials are doing so legitimately are 
underutilized. 



Page 35 



GAO-08-598 Nuclear Security 



Recommendations for 
Executive Action 



Given the repeated delays in implementing improvements to the Nuclear 
Regulatory Commission's ability to monitor and track radioactive sealed 
sources, we recommend that the Chairman of the Nuclear Regulatory 
Commission take steps, consistent with sound systems development 
practices, to ensure that priority attention is given to meeting the current 
January 2009 and summer 2010 target dates for launching the National 
Source Tracking System, Web-based licensing system, and the new license 
verification system, respectively. 



In addition, because some quantities of radioactive materials are 
potentially dangerous to human health if not properly handled, we 
recommend that the Nuclear Regulatory Commission complete the steps 
needed to include all potentially dangerous radioactive sources (category 
3 and the larger category 4 sources, as well as categories 1 and 2) in the 
National Source Tracking System as quickly as is reasonably possible. 



Finally, to improve the likelihood of preventing radioactive sources and 
materials from being smuggled into the United States, we recommend that 
the Secretary of Homeland Security direct the Commissioner of Customs 
and Border Protection to 



• effectively communicate current Customs and Border Protection 
guidance to officers at ports of entry regarding when they are required 
to contact the National Targeting Center to verify that radioactive 
materials are legitimately licensed, and 

• take measures to ensure that this guidance is being followed. 



Agency Comments 
and Our Evaluation 



We provided the Chairman of the Nuclear Regulatory Commission, the 
Secretary of Homeland Security, the Secretary of Energy, the 
Administrator of the Environmental Protection Agency, and the Chair of 
the Organization of Agreement States with draft copies of our report for 
their review and comment. 



In commenting on the draft of this report, NRC neither agreed nor 
disagreed with our findings and recommendations. Instead, NRC 
described its current efforts to implement the recommendations from our 
2003 report. On this point, NRC outlined the steps it is taking to modify 
and strengthen its processes and procedures for licensing radioactive 
materials. NRC also provided an update on the status of the efforts of the 
Radiation Source Protection and Security Task Force's subgroup on public 
education — a subgroup led by DHS of which NRC is a member — to 
proactively educate the general public about radiation with the goal of 
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reducing public anxiety and mitigating the adverse psychological effects in 
the event of an RDD attack. Finally, NRC described its proposed rule, 
expected to be issued in the fall of 2009, to limit the quantity of radioactive 
material allowed in a generally licensed device. Although we are 
encouraged by NRC's efforts to finish implementing the recommendations 
from our 2003 report, we remain concerned that nearly 5 years after we 
issued our report these recommendations have yet to be fully 
implemented. Furthermore, NRC stated that it is taking the steps 
necessary to launch the National Source Tracking System (NSTS) and 
Web-based licensing and to complete the needed steps to include all 
potentially dangerous radioactive sources in the NSTS as quickly as is 
reasonably possible. In addition, NRC assures that it intends to place the 
highest priority on the completion and deployment of the NSTS and Web- 
based licensing system. However, we are concerned that NRC has once 
again postponed its estimated completion dates for these systems — by at 
least 9 months in the case of expanding NSTS to include the smaller but 
still potentially dangerous radioactive sources and estimates a similar 
delay in the deployment of the Web-based licensing system. Finally, in its 
technical comments, NRC informed us that it is developing a new, third 
system which will draw information from both the NSTS and the Web- 
based licensing system to provide an improved capability for vendors and 
regulators to verify licensing information. While we hope this new, third 
system provides the intended additional capabilities, we are concerned 
that after so many delays with NSTS and the Web-based licensing system, 
adding a third system may further delay the ultimate security benefits that 
these systems are expected to provide. NRC also provided additional 
technical comments, which we incorporated into the report as 
appropriate. 

The other federal agencies that were offered the opportunity to comment 
on our report either agreed with our recommendations and outlined the 
steps to be taken to implement them, or chose not comment on the final 
draft. Specifically, according to DHS's written comments, CBP concurred 
with our recommendations and specified the steps it will take to 
effectively communicate current Customs and Border Protection guidance 
to officers at ports of entry regarding when they are required to contact 
the National Targeting Center to verify that radioactive materials are 
legitimately licensed, and the measures it will take to ensure this guidance 
is being followed. In fact, CBP has already updated its current guidance to 
CBP officers at the border by issuing a memorandum to the field directors 
restating and clarifying when officers must contact the National Targeting 
Center to verify that radioactive materials are legitimately licensed and 
requiring them to incorporate this guidance into ports of entry standard 
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operating procedures. Finally, DOE and EPA reviewed and provided 
comments on earlier versions of our draft report and, after reviewing our 
final draft, had no further comments. 

The Organization of Agreement States neither agreed nor disagreed with 
our findings and recommendations, but offered two comments which we 
incorporated into the report. Specifically, state officials thought it was 
important to recognize the quality of agreement state regulatory programs 
by highlighting the fact that while GAO investigators succeeded in 
obtaining an NRC radioactive materials license using fictitious documents, 
GAO withdrew its application to obtain a materials license from the 
agreement state when that state informed GAO investigators that it would 
take steps that would have revealed the application not to be authentic. 
State officials also wanted to stress what they view as the high level of 
collaboration they enjoy with NRC, as evidenced by the number of state 
officials involved in security-related working groups with NRC officials 
and the financial support that NRC provides to states to enable this level 
of state participation. 



As agreed with your offices, unless you publicly announce the contents of 
this report, we plan no further distribution until 24 days from the report 
date. At that time, we will send copies of this report to the Chairman of 
the Nuclear Regulatory Commission, the Secretary of Homeland Security, 
the Secretary of Energy, the Administrator of the Environmental 
Protection Agency, the Chair of the Organization of Agreement States, and 
interested congressional committees. We will also make copies available 
to others upon request. In addition, this report will be available at no 
charge on the GAO Web site at http://www.gao.gov. 
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If you or your staffs have any questions about this report, please contact 
me at (202) 512-3841 or aloisee@gao.gov. Contact points for our Offices of 
Congressional Relations and Public Affairs may be found on the last page 
of this report. GAO staff that made major contributions to this report are 
listed in appendix V. 




Gene Aloise 

Director, Natural Resources 
and Environment 
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Appendix I: Potential Effects of a 
Radiological Dispersal Device with Category 
1, 2, and 3 Quantities of Radioactive Material 



A radiological dispersal device (RDD) is any type of device that is intended 
to disperse radioactive materials, through conventional explosives or 
other means. Among the federal agencies, the Environmental Protection 
Agency (EPA) has lead responsibility for providing radiological emergency 
planning guidance, known as Protective Action Guides (PAG), to protect 
the public from exposure to radiation. In addition, the Department of 
Homeland Security (DHS) issued PAGs for responses to RDD and 
improvised nuclear devices (IND) for interim use and comment. Both 
EPA's and DHS's PAGs can be used by other federal agencies or state 
governments to develop their own guidance or regulations to protect 
public health. According to EPA officials, the general public's fear of 
radiation, coupled with most law enforcement officers' relative 
inexperience dealing with radioactive material, would likely cause any 
emergency incident that triggers first responders' radiation detectors to be 
treated as an RDD. Until the type and specific quantity of radioactive 
material could be determined, the situation would initiate a federal 
response, whether or not specific, federal thresholds for safety have been 
reached. Even very small amounts of radioactive material are sufficient to 
set off the radiation detectors of first responders. 

For purposes of illustration (see table 3), we calculated how large an area 
might be sufficiently contaminated using International Atomic Energy 
Agency (IAEA) category 1, 2, and 3 quantities of cesium-137 — assuming 
the material could be evenly distributed — to (1) trigger the EPA PAG 
recommending relocation of the public until the site is cleaned up and (2) 
reach the threshold at which potential direct health effects, such as 
radiation sickness, might occur. We used category 2 and 3 amounts of 
cesium-137 (one of the 16 radionuclides of concern) because, according to 
the International Atomic Energy Agency categorization scheme, the 
threshold category 3 quantity is the amount at which a radionuclide 
becomes potentially dangerous to human health if not handled 
appropriately. A category 2 quantity of a radioactive material is at least 10 
times more dangerous than the category 3 threshold quantity and is also 
the level at which NRC requires licensees to take additional security 
measures to protect the material from unauthorized access or use. We 
calculated how large an area might be contaminated with a category 1 
quantity of cesium-137 because such quantities can be found in medical 
devices and irradiators throughout the United States. 
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Appendix I: Potential Effects of a 
Radiological Dispersal Device with Category 
1, 2, and 3 Quantities of Radioactive Material 



Table 3: Potential Contamination from an RDD 


Amount of radioactive material (cesium-137) 


Thresholds for concern 
(based on 1 year of exposure) 


Category 3 
threshold 
(2.7 curies) 


Category 2 
threshold 
(27 curies) 


Category 1 
threshold 
(2,700 curies) 


EPA recommends relocation (2 rem) 8 


15.1 acres 


150.7 acres 


15,012 acres 


Potential observable health effects 
(100 rem) 


0.3 acre 


3 acres 


300 acres 



Source: GAO. 

Notes: Calculations based on the Department of Energy's Federal Regulatory Monitoring and 
Assessment Center dose assessment methodology. The potential area contamination figures assume 
uniform ground deposition of radioactive material, which is difficult to accomplish and may not be 
realistic. 

°A rem is a term scientists use to describe how much radiation the body absorbs, multiplied by a 
quality factor for the various types of radiation (e.g., alpha, beta, gamma, or neutron). For example, 
scientists estimate that the average person receives 360 millirem (0.36 rem) every year from natural 
(such as radon gas) and manufactured radiation sources (such as exposure to radioactive isotopes 
used in some medical procedures). 

Specifically, when the potential additional exposure to radiation for a 
person remaining in a given area for 1 year reaches 2 rem, EPA considers 
the area sufficiently dangerous to recommend that people be relocated 
until the site can be decontaminated. When the potential exposure to 
radiation over the course of 1 year reaches 100 rem, the International 
Commission on Radiological Protection — an organization of radiation 
scientists from around the world who provide recommendations regarding 
radiation exposure — concludes that readily observable health effects, such 
as radiation sickness, are possible with extended exposure. Only a 
category 1 quantity would be likely to produce health effects due to acute 
radiation doses. This level, however, is still substantially below the level at 
which prompt fatalities could occur. (Prompt fatalities from untreated 
radiation exposure may only result from acute radiation doses — that is, 
doses delivered in their entirety in a matter of hours or days — of at least 
hundreds of rem from a predominately beta-gamma emitting radionuclide 
like cesium-137.) 

EPA guidance is based on protecting human health and calculating the 
odds that radiation exposure will lead to cancer, the most common of 
radiation's long term side effects. In the event of an RDD, federal RDD 
PAGs, such as those issued by DHS in 2006, would be used to manage the 
response to the incident. PAGs are operative during the emergency, and 
their chief goal is to protect the public by providing standards to guide the 
response in the early and intermediate phases of an incident. However, 
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any PAG guidance is only a series of recommendations and is not legally 
enforceable or binding. 

Furthermore, a PAG does not establish cleanup levels. In fact, guidance for 
specific cleanup levels after an RDD has been deliberately left ad hoc, and 
is to be established after an evaluation occurs using an "optimization" 
process for long-term site cleanup and restoration. The level to which a 
contaminated site would be cleaned up for the long term would be agreed 
upon after the emergency has passed and would depend on the uses of the 
site. A cleanup standard would factor in the lifetime exposure that the 
contamination creates for the people using the site — generally, the long- 
term increased risk of developing cancer. For example, a site that is used 
for business purposes, where the typical person would spend only working 
hours, would not have to be cleaned up to the same level as a site where 
people live, where some people could reasonably be exposed to the post- 
cleanup radiation levels 24 hours a day. Public involvement in the decision 
would play a significant role in determining what risk levels are 
acceptable. While EPA provides guidelines, state and local authorities 
make the ultimate decisions under most scenarios. 
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UNITED STATES 
NUCLEAR REGULATORY COMMISSION 



WASHINGTON. D.C. 



May 28, 2008 



Mr, Gene Aioise, Director 

Natural Resources and Environment 

U.S. Government Accountability Office 

441 G Street, NW 

Washington, D.C. 20548 

Dear Mr. Aioise: 

On behalf of the U.S. Nuclear Regulatory Commission (NRC), i am responding to your 
e-mail dated April 21, 2008, requesting NRC review and comment on your draft report, "Nuclear 
Security: NRC and DHS Need to Take Additional Steps to Better Track and Detect Radioactive 
Materials" (GAO-08-598). I appreciate you providing the NRC the opportunity to review this 
draft report and the time and effort that you and your staff have invested in reviewing this 
important topic. 

NRC's leadership role in applying a risk-based approach has enhanced security of 
radioactive materials and has reduced the potential threat from a radiological dispersal device 
(RDD) or radiological exposure device. As a result, these materials are significantly more 
secure than before the events of September 1 1 , 2001 . NRC is working closely with its domestic 
and international partners to continuously assess, integrate, and improve its security programs 
to make risk-significant radiation sources more secure and less vulnerable to terrorists. 

Specifically, the U.S. Government Accountability Office (GAO) noted that the NRC has 
made limited progress toward implementing 3 of the 6 recommendations in the 2003 report on 
security of radioactive sources. The GAO recommended that the NRC: (1 ) modify its process 
for issuing licenses to ensure that radioactive materials cannot be purchased by individuals with 
no legitimate need for them; (2) determine how to effectively mitigate the potential psychological 
effects of malicious use of such materials; and (3) examine whether certain radioactive sources 
should be subject to more stringent regulations. With regard to these recommendations, the 
NRC and its Federal and Agreement State partners have made and are making significant 
progress towards achieving these goals. 

Beginning in January 2008, the NRC has modified its licensing process and now 
conducts pre-licensing site visits for all unknown applicants before issuing new licenses. The 
new procedure was tested in a pilot project with the Agreement States. The procedure will be 
revised based on comments received from licensing reviewers in the NRC Regions and the 
Agreement States as a result of the pilot project. These actions are aiding in the prevention of 
illegitimate purchases of radioactive materials. 

The NRC is working with its Federal and Agreement State partners to address the issue 
of mitigation of potential psychological effects of an RDD through the Radiation Source 
Protection and Security Task Force's {Task Force) subgroup on public education, which is 
chaired by the Department of Homeland Security. As noted in their December 2007 Draft Public 
Education Action Plan, proactively educating the public about radiation in general and the 
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specific radiation risks associated with RDDs may reduce the public's anxiety and ameliorate 
adverse psychological impacts in the event of an RDD attack. This plan was presented to the 
Task Force on May 15, 2008. 

Additionally, the Task Force has reactivated the radiation sources subgroup to 
reevaluate the list of radioactive sources that warrant enhanced security and protection. The 
subgroup's proposed evaluation will take economic, physical, psychological, and social 
disruption consequences into consideration. The results will be presented to the Task Force by 
November 2008. The combined work planned by these two subgroups will address mitigation of 
psychological impacts of a RDD and address whether enhanced security measures may be 
warranted for certain radioactive materials. 

With regard to whether generally licensed radioactive sources should be subject to more 
stringent regulations, the NRC formed a rulemaking working group which included State 
representatives in September 2007, to consider which sources should be specifically licensed. 
The working group has drafted a proposed rule to limit the quantity of radioactive material 
allowed in a generally licensed device. The draft proposed rule is currently being reviewed by 
the NRC and the Agreement States and is expected to be issued for public comment this fail. 
The final rule is projected to be issued in fall 2009. 

In addition to providing a status update on the NRC's progress in implementing the 
recommendations from the 2003 report, the GAO also recommended that the Chairman of the 
NRC take steps, consistent with sound systems development practices, to: ( 1 ) ensure that 
priority attention is given to meeting the current January and October 2009 target dates for 
launching the National Source Tracking System (NSTS) and Web-based Licensing (WBL) 
System, respectively, and (2) complete the needed steps to include all potentially dangerous 
radioactive sources in the NSTS as quickly as is reasonably possible. 

With regard to the GAO's recommendation that the NRC take steps to ensure that 
priority attention is given to meeting the current January and October 2009 target dates for 
launching the NSTS and WBL systems, I want to assure you that the Commission has placed a 
high priority in the deployment of these systems. In accordance with Office of Management and 
Budget guidance, the NRC has employed sound system development practices. The NRC has: 
(1) assigned professionally certified project managers to both NSTS and WBL; (2) set 
reasonable performance baselines and integrated project schedules for both NSTS and WBL; 
and (3) employed earned value management on the NSTS project and will employ it on the 
WBL project once a contract is in place. The NSTS is on schedule for deployment in January 
2009. Additionally, a proposed rule has been issued for public comment, which would expand 
NSTS beyond Category 2 sources to include Category 3 and 1/10'" of the Category 3 threshold 
values. The final rule is projected to be issued in early 2009. The October 2009 target date for 
WBL deployment was based upon having a contract awarded and a preliminary estimate of 
remaining work. The NRC has encountered delays in awarding the contract, which are based 
on changing scope and requirements to meet current programmatic needs. NRC's goal is to 
have the contract awarded by late summer 2008 and to have the system deployed 24 months 
later. 
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Enclosed are additional comments related to enhancing the clarity and accuracy of 
statements in the body of the report. Should you have any questions about these comments, 
please contact Mr. Jesse Ariidsen of my staff at (301 ) 41 5-1 785. 



Enclosure: 

NRC Comments on the GAO's Draft Report, 
"Nuclear Security: NRC and DHS Need to 
Take Additional Steps to Better Track and 
Detect Radioactive Materials" {GAO-08-598) 



Sincerely, 




R.wTBofchardt 
Executive Director 
for Operations 
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US. Department of Homeland Security 

\\d,£tuu;i<m DC 2052* 




Homeland 
Security 



June 2, 2008 



Mr. Gene Aloise 

Director, Natural Resources and Environment 
U.S. Government Accountability Office 
Washington, D. C. 20548 

Dear Mr. Aloise: 

Thank you for providing us with a copy of the draft report entitled "NUCLEAR SECURITY: NRC 
and DHS Need to Take Additional Steps to Better Track and Detect Radioactive Materials' (GAO- 
08-598) where GAO was requested to assess: 1) the progress NRC has made in implementing 2003 
recommendations; 2) other steps NRC has taken to improve its ability to track radioactive 
materials; 3) Customs and Border Protection's (CBP's) ability to detect radioactive materials at 
land ports of entry; and 4) CBP's ability to verify that such materials are appropriately licensed 
before they are allowed to enter the United States. 

CBP concurs with GAO's recommendation that CBP effectively communicate current CBP guidance to 
officers at ports of entry regarding when they are required to call the National Targeting Center to verify 
the legitimacy of radioactive materials; and take measures to ensure that this guidance is being followed. 



1 ) Issue guidance to officers at ports of entry regarding w hen they are required to call the 
National Targeting Center to verify the legitimacy of radioactive materials. 

2) Have all field offices ensure that the port's Standard Operating Procedures include the guidance. 
Due Date: March 31, 2009. 

We thank you again for the opportunity to review the draft report and provide comments. 



CBP will: 




Sincerely, 



Penelope G. McCormack 
Acting Director 

Departmental GAO/OIG Liaison Office 
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Organization of Agreement States 




Cindy Card well, Chair, Texas 
Julia Schmitt, Chair-Elect, Nebraska 
Paxil Schmidt, Past Chair, Wisconsin 
Tom Conley, Treasurer, Kansas 
Isabelle Busenitz, Secretary, Kansas 
Lee Cox, Director, North Carolina 
Ann Troxler, Director, Louisiana 



May 27, 2008 



Gene Aloise 

Director, Natural Resources and Environment U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Aloise: 

Please accept the comments below on behalf of the Board of the Organization of Agreement 
States on the draft report on Nuclear Security, which you provided to us during the week of April 
2 1 , 2008 and for the statement of facts provided to us in March. We've noted the changes from 
the earlier document to this one. 

In the section of the report beginning on page 1 8, which discusses GAO's ability to obtain a 
license from NRC for a false company, no mention is made of GAO's attempt to obtain a license 
from an Agreement State. GAO subsequently abandoned that attempt when the licensing 
process of the Agreement State was made known. The Agreement States believe this is very 
significant, not only because an Agreement State's actions caused such an attempt to be 
abandoned, but because this points out the very real fact that the licensing process may indeed 
differ. Agreement State programs may go to different lengths in verifications made during the 
licensing process. So, the fact that GAO obtained a license from one regulatory agency is not 
indicative that the same would happen with any other regulatory agency. 

Although collaboration between NRC and the Agreement States is mentioned several times 
throughout the report, we do not believe this point is emphasized enough. Currently, there are an 
unprecedented number of security-related working groups involving NRC and Agreement State 
staff members. The fact that the states are able to obtain volunteers to work on all of these 
working groups and that NRC is funding the travel involved with such efforts, is a testament to 
our belief in the importance of ensuring security of radioactive material in this country. 

We appreciate the opportunity to review the report and provide comments. Thank you for your 
patience. 

Sincerely, 



Cindy Cardwell, Chair 
Organization of Agreement States 
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